diff --git a/contrib/index.html b/contrib/index.html
index c528d9e3..286b3da8 100644
--- a/contrib/index.html
+++ b/contrib/index.html
@@ -26,8 +26,8 @@ a {
 	<script>
 
 var a = document.getElementById('redir'),
-	proto = window.location.protocol.indexOf('https') === 0 ? 'https' : 'http',
-	loc = window.location.hostname || '127.0.0.1',
+	proto = location.protocol.indexOf('https') === 0 ? 'https' : 'http',
+	loc = location.hostname || '127.0.0.1',
 	port = a.getAttribute('href').split(':').pop().split('/')[0],
 	url = proto + '://' + loc + ':' + port + '/';
 
@@ -35,7 +35,7 @@ a.setAttribute('href', url);
 document.getElementById('desc').innerHTML = 'redirecting to';
 
 setTimeout(function() {
-	window.location.href = url;
+	location.href = url;
 }, 500);
 
 </script>
diff --git a/copyparty/web/baguettebox.js b/copyparty/web/baguettebox.js
index 85ffad38..d5e55da6 100644
--- a/copyparty/web/baguettebox.js
+++ b/copyparty/web/baguettebox.js
@@ -875,7 +875,7 @@ window.baguetteBox = (function () {
 
         if (loopB !== null) {
             timer.add(loopchk);
-            sethash(window.location.hash.slice(1).split('&')[0] + '&t=' + (loopA || 0) + '-' + loopB);
+            sethash(location.hash.slice(1).split('&')[0] + '&t=' + (loopA || 0) + '-' + loopB);
         }
     }
 
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index cef56544..2f8e464e 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -3915,9 +3915,9 @@ var showfile = (function () {
 	window.Prism = { 'manual': true };
 	var em = QS('#bdoc>pre');
 	if (em)
-		em = [r.sname(window.location.search), location.hash, em.textContent];
+		em = [r.sname(location.search), location.hash, em.textContent];
 	else {
-		var m = /[?&]doc=([^&]+)/.exec(window.location.search);
+		var m = /[?&]doc=([^&]+)/.exec(location.search);
 		if (m) {
 			setTimeout(function () {
 				r.show(uricom_dec(m[1]), true);
@@ -3937,7 +3937,7 @@ var showfile = (function () {
 	};
 
 	r.active = function () {
-		return document.location.search.indexOf('doc=') + 1;
+		return location.search.indexOf('doc=') + 1;
 	};
 
 	r.getlang = function (fn) {
@@ -5702,7 +5702,7 @@ var treectl = (function () {
 		}
 		var href = this.getAttribute('href');
 		if (R && !href.startsWith(SR)) {
-			window.location = href;
+			location = href;
 			return;
 		}
 		r.reqls(href, true);
@@ -5758,7 +5758,7 @@ var treectl = (function () {
 			var res = JSON.parse(this.responseText);
 		}
 		catch (ex) {
-			window.location = this.top;
+			location = this.top;
 			return;
 		}
 
@@ -5818,7 +5818,7 @@ var treectl = (function () {
 
 		for (var a = 0; a < res.files.length; a++)
 			if (/^index.html?(\?|$)/i.exec(res.files[a].href)) {
-				window.location = vjoin(top, res.files[a].href);
+				location = vjoin(top, res.files[a].href);
 				return true;
 			}
 	};
diff --git a/copyparty/web/md.js b/copyparty/web/md.js
index 2679a13b..348eaaa1 100644
--- a/copyparty/web/md.js
+++ b/copyparty/web/md.js
@@ -507,11 +507,12 @@ dom_navtgl.onclick = function () {
     redraw();
 };
 
-if (!HTTPS)
+if (!HTTPS && location.hostname != '127.0.0.1') try {
     ebi('edit2').onclick = function (e) {
         toast.err(0, "the fancy editor is only available over https");
         return ev(e);
     }
+} catch (ex) { }
 
 if (sread('hidenav') == 1)
     dom_navtgl.onclick();
diff --git a/copyparty/web/msg.html b/copyparty/web/msg.html
index e89d3755..72025919 100644
--- a/copyparty/web/msg.html
+++ b/copyparty/web/msg.html
@@ -42,7 +42,7 @@
 	{%- if redir %}
 	<script>
 		setTimeout(function() {
-			window.location.replace("{{ redir }}");
+			location.replace("{{ redir }}");
 		}, 1000);
 	</script>
 	{%- endif %}
diff --git a/copyparty/web/up2k.js b/copyparty/web/up2k.js
index e196f47b..54592b1e 100644
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -807,7 +807,7 @@ function up2k_init(subtle) {
     function init_deps() {
         if (!loading_deps && !got_deps()) {
             var fn = 'sha512.' + sha_js + '.js',
-                m = L.u_https1 + ' <a href="' + (window.location + '').replace(':', 's:') + '">' + L.u_https2 + '</a> ' + L.u_https3;
+                m = L.u_https1 + ' <a href="' + (location + '').replace(':', 's:') + '">' + L.u_https2 + '</a> ' + L.u_https3;
 
             showmodal('<h1>loading ' + fn + '</h1>');
             import_js(SR + '/.cpr/deps/' + fn, unmodal);
@@ -1588,7 +1588,7 @@ function up2k_init(subtle) {
             return;
 
         st.oserr = true;
-        var msg = HTTPS ? L.u_emtleak3 : L.u_emtleak2.format((window.location + '').replace(':', 's:'));
+        var msg = HTTPS ? L.u_emtleak3 : L.u_emtleak2.format((location + '').replace(':', 's:'));
         modal.alert(L.u_emtleak1 + msg + (CHROME ? L.u_emtleakc : FIREFOX ? L.u_emtleakf : ''));
     }
 
diff --git a/copyparty/web/util.js b/copyparty/web/util.js
index e3dc3de2..83dcf33b 100644
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -13,7 +13,7 @@ var wah = '',
     R = SR.slice(1),
     RS = R ? "/" + R : "",
     HALFMAX = 8192 * 8192 * 8192 * 8192,
-    HTTPS = (window.location + '').indexOf('https:') === 0,
+    HTTPS = ('' + location).indexOf('https:') === 0,
     TOUCH = 'ontouchstart' in window,
     MOBILE = TOUCH,
     CHROME = !!window.chrome,